I know Mastodon hates LLM's and AI.
-
@jti42 @jeroen94704 @drwhax yes, in the process. Thankfully, I saved money and invested to the point I don’t have to work anymore and I’m moving to my countryside house in Korea
@jti42 @jeroen94704 @drwhax Btw, I don’t usually talk with people that uses AI generated avatars.
You disrespect yourself and burn the planet. Consider this our last interaction.
-
@drwhax I also had a serious discussion with my husband this morning about llms and particularly genAi. What I took away from it was the data centers that we’re building now here are not efficient or ethical (imo) we need to make them efficient and ethical for security reasons. The vulnerability issue is immensely important here. While private companies are making Ai terrible and data centers by them are even worse, there needs to be more change in how it all works before we lose it altogether.
@drwhax China is building data centers every month, run on so much solar & wind energy that they produce. They are running campaigns everywhere else for other countries to not build them. Once they have greater computing capacity than needed they can control the entire electric communications systems.
We need to run a system of clean energy & better cooling systems for data centers if we want to live the life we know/have known. China doesn’t share, it exploits. (Sorry for the rant
) -
@drwhax China is building data centers every month, run on so much solar & wind energy that they produce. They are running campaigns everywhere else for other countries to not build them. Once they have greater computing capacity than needed they can control the entire electric communications systems.
We need to run a system of clean energy & better cooling systems for data centers if we want to live the life we know/have known. China doesn’t share, it exploits. (Sorry for the rant)@drwhax Do I want more data centers the way they are run right now by private companies? No. But we need to do it better and more efficiently than them or else… no computer or device will be safe.
I really think we need this discussion more. And more done about it -
@drwhax Do I want more data centers the way they are run right now by private companies? No. But we need to do it better and more efficiently than them or else… no computer or device will be safe.
I really think we need this discussion more. And more done about it@em_and_future_cats we both agree on this! I don't see them making a profit on these gigantic datacenters either!
-
@em_and_future_cats we both agree on this! I don't see them making a profit on these gigantic datacenters either!
@em_and_future_cats that is to say, were abusing huge plots of land for... what exactly??
-
@em_and_future_cats we both agree on this! I don't see them making a profit on these gigantic datacenters either!
@drwhax YES!!!
-
@em_and_future_cats that is to say, were abusing huge plots of land for... what exactly??
@drwhax And water! There are other ways to cool and process data ,(I have a computer science major who I talk with and they had a good suggestion but I don’t remember what it was called!
) -
@drwhax And water! There are other ways to cool and process data ,(I have a computer science major who I talk with and they had a good suggestion but I don’t remember what it was called!
)@em_and_future_cats It might've been immersion cooling
https://en.wikipedia.org/wiki/Immersion_cooling (although I don't know what the difference would be when it would come to electricity..) -
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
Bruh.
"I know LLMs are making the world worse in every way imaginable, but the speed at which they can do it is so impressive! Here's a ten-bullet-point blog post on how I set my neighborhood on fire and made my neighbors homeless..."
️ -
@em_and_future_cats It might've been immersion cooling
https://en.wikipedia.org/wiki/Immersion_cooling (although I don't know what the difference would be when it would come to electricity..)@drwhax This certainly rings a bell!
The electricity part needs to be supplied by solar and wind energy which China showed us that it can work tremendously well!!!
Also, I love to point out that recent studies suggest that the amount of land needed to be covered by solar voltaic systems to supply the energy the country needs is a fraction of what is ALREADY COVERED by asphalt and buildings. We can do this if we put our minds to it!!! -
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax the thesis here seems to be that a new threat vector – LLM-based bad actors – puts otherwise stable systems at risk. The recommendation appears to be to employ these same LLMs in an attempt out flank the bad actors.
While I am not entirely opposed to well reasoned application of LLMs and associated tooling and harnesses to a problem, I question whether a strategy based on matching rather than one-upping the bad actors is a viable one.
There is certainly value in adapting the security model of many projects, but it’s less clear to me that simply “running an LLM” over a codebase is the answer.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Beware the "if it's internet facing or something critical": this line of thinking will bite you sooner than you think
-
@drwhax Beware the "if it's internet facing or something critical": this line of thinking will bite you sooner than you think
@monnier Anything else is also fine, it's a good first step
-
@drwhax the thesis here seems to be that a new threat vector – LLM-based bad actors – puts otherwise stable systems at risk. The recommendation appears to be to employ these same LLMs in an attempt out flank the bad actors.
While I am not entirely opposed to well reasoned application of LLMs and associated tooling and harnesses to a problem, I question whether a strategy based on matching rather than one-upping the bad actors is a viable one.
There is certainly value in adapting the security model of many projects, but it’s less clear to me that simply “running an LLM” over a codebase is the answer.
@kaleb I think it's a decent first step beyond, ideally we remove a ton of bug classes ala snufflepagus.
-
@mweiss @buherator @drwhax Totally, I'm pretty sure that risks that "end/pause business" will be addressed soon-ish. However, risks that are... less so, e.g., data loss, data privacy stuff, ... we'll just get used to it. Or the many downtimes of GitHub.
@ljrk @buherator @drwhax something changed around 2020 when businesses "learned" that these events weren't ending companies. And cyber insurance made that particular problem worse.
-
@zimzat No one wants to fund it is what I think.
Suhosin did something like this for PHP, now it's just jvoisin maintaining snufflepagus: https://github.com/jvoisin/snuffleupagus
I don't remember if there was something similar for other languages. Grsecurity for the Linux Kernel, that's the three I know
-
@em_and_future_cats @zimzat unfortunately less cute than Mr Snufflepagus: https://en.wikipedia.org/wiki/Mr._Snuffleupagus
-
@em_and_future_cats @zimzat unfortunately less cute than Mr Snufflepagus: https://en.wikipedia.org/wiki/Mr._Snuffleupagus
-
@SDRHoernchen Yes, I think this is a huge problem and it shows a huge gap. Sadly, I don't think this will be fixed as the line between offence and defence is too thin these days.
@drwhax Every time we could have software security we look the other way and find a reason not to have it, and now we have to bet on China and Kimi 3 et al because the western frontier models are not seen as tools to be used but perceived as dangers to a world of shitty software.
Imagine getting on a plane with the assumption that the wings are gonna fall off if suicidal passengers discover the missing nuts and bolts! The whole notion of that line is the problem when talking about software.
-
I know Mastodon hates LLM's and AI. So here goes!
I recently got access to trusted access of cyber capabilities of both openai and anthropic, which also allows you to weaponize security vulnerabilities.
The speed at which these parrots can find bugs and be creative enough to exploit them is staggering.
I recently pointed an LLM at an kernel fix that was reachable by an unprivileged namespace on Debian and it fully weaponized it, without too much me prompting it in the right direction, in about 7-9 hours.
I don't think open-source and companies will know what's coming for them once these open-source weight models will have broader reach and get better at exploiting vulnerabilities on a massive scale as anyone can access them.
The bottom line I think is, you cannot patch faster than the attackers can easily chain all kinds of vulnerabilities together and just move laterally on an incredibly fast pace.
I've started reporting vulnerabilities to all kinds of projects and the majority have trouble or patching issues found. There's not enough maintainers, or there's simply none anymore.
I've been getting quite worried about what our future will look like for data privacy. I think outright not running an LLM over your codebase to find critical security vulnerabilities because of your moral stance will keep us more insecure.
Please run an LLM over your code base if it's internet facing or something critical, we thank you!
Can't wait for the discussions on this!
@drwhax Blue team can't just throw an agent at a codebase, right now that will get them a bunch of false positives. Eventually, that triage will also get automated up to a certain point, but you maybe shouldn't be waiting for that.
